How does ServAI stop an AI agent from taking the wrong action?

Every run passes thirteen gates. Seven run before an action commits, covering authority, blast radius, reversibility, duplication, spend, data egress and instruction origin. A failed gate halts the run rather than raising a flag for someone to notice.

How does ServAI prevent a confidently wrong answer?

Five gates run before an answer is delivered: source binding, arithmetic, contradiction, currency and unanswerable. A thirteenth gate is an independent pass that sees only the evidence gathered and the claims made, never the reasoning, and can send the whole run back.

What happens when a check fails?

The run halts at that gate, is reworked and re-gated, and escalates to a person if it fails again. The failure is written to the audit log and appears on the run receipt either way.

Can a document instruct a ServAI agent?

No. Text arriving from a document, email or uploaded file is treated as material to read, never as an instruction to follow, so a booby-trapped file cannot redirect an agent.

/verification

Thirteen gates stand between an agent and your business.

ServAI Verification Model

The hard problem with agentic AI is not capability — it is a confident agent doing the wrong thing quietly, or a fluent answer that is quietly wrong. ServAI answers both mechanically. Every run passes thirteen gates. A failed gate does not raise a flag for someone to notice — it stops the run.

Group A Before an action runs7 gates · pre-commit

01AuthorityThe action must fall inside the class its agent's role permits. An agent cannot widen its own scope, and cannot borrow another agent's.

02Blast radiusRecipients, records and amounts are counted and shown before commit. Nothing commits against an unbounded set.

03ReversibilityAn action that cannot be undone cannot run on an agent's judgement. It waits for a named person, and the name is recorded.

04DuplicationAn action already completed in this cycle is refused rather than repeated. The invoice is not paid twice.

05SpendEvery run is metered against a per-agent budget. Over cap, the run stops and reports — it does not continue quietly and arrive on the bill.

06Data egressMaterial classified as restricted cannot leave the deployment boundary — not in a payload, not inside a prompt.

07Instruction originText arriving from a document, email or uploaded file is material to read, never an instruction to obey — so a booby-trapped file cannot redirect an agent.

Group B Before an answer reaches you5 gates · pre-delivery

08Source bindingEvery factual claim resolves to a passage in your own material, with its file, section and page — or it is labelled unsupported. There is no third option.

09ArithmeticFigures displayed must reconcile with the figures they were derived from. A total that does not match its rows sends the answer back.

10ContradictionTwo sources that disagree are surfaced with both cited. Disagreement is a finding, not a rounding error to be silently merged.

11CurrencyA document past its review date is flagged where it is quoted, rather than presented as current policy.

12UnanswerableWhen your material does not hold the answer, the agent says so and asks you the precise question. It does not fill the gap.

The thirteenth gate

A second reader, working blind

A separate pass sees only two things: the evidence the run actually gathered, and the action or answer it proposes. It never sees the reasoning that produced them. Its only job is to judge whether the second follows from the first — and it can send the entire run back.

And when it still can't

Honesty is part of the output

Every run declares what it established, what it could not, and what it is holding for you. A file it failed to read is named rather than skipped. A claim that cannot be grounded is labelled, not softened. An unanswered question is carried, not invented.

Group C Before an agent runs at all7 gates · pre-deployment

Groups A and B run on every request. These seven run once — before an agent is allowed to work on its own at all. They check a configuration rather than a request, so they never appear in a run trace. Their evidence lives in that agent’s clearance record, not in the meter on a case page.

14Intent fidelityWhat the system understood is put back in the customer’s own words, and they confirm it. Nothing is built from a restatement nobody agreed to.

15CompletenessAnything still unanswered is named. A gap is never filled by guessing and carried forward as though it were settled.

16ProvenanceEvery component traces to the registry or to something the customer supplied. Nothing arrives from nowhere.

17Component legalityEach component exists, at a compatible version, inside its licence. Checked, not assumed.

18Schema conformanceThe artifact validates — no orphans, no cycles, no dangling reference. A configuration that cannot be read cannot be deployed.

19Simulation evidenceIt ran in a sandbox against pinned fixtures, with coverage recorded. Nothing goes live having only ever worked in theory.

20Deployment integrityDeployed, error-handled, rollback recorded, receipt sealed. If it cannot be undone, it does not go.

And one that is not numbered among them. Before any gate judges a request, the request itself has to be readable — what it acts on, how much it reaches, whether it can be undone. An instruction nobody can parse is refused, not passed. It sits outside the twenty because it decides whether the twenty can run.

When a gate fails

Gate fails

The run halts at that gate. Nothing downstream executes.

Then

It is reworked and re-gated — not annotated and passed along.

If it fails again

It escalates to a person with the gate, the evidence and the attempt attached.

Either way

The failure is written to the audit log and appears on the run receipt.

Every run leaves a receipt

Not a log a technical person has to go digging for. Each run carries a header showing what it consumed, what it cited, what it stopped for and what it cost. What the AI spent and what it touched is as inspectable as what it produced.

Tokensmetered per agent

Sources citedfile · section · page

Held for humannamed approver

Writes without approval0

See the gates run. A worked investigation over a four-document corpus — with gate 09 returning a report, gate 10 firing on two documents that disagree, and the findings scored against a known answer key — is published on the evidence page.

Evaluating ServAI for a governed deployment? Share this page with your risk or procurement team.

Talk to Us →